ikelos and GitHub
bf03ecda2c
Merge pull request #1564 from Abyss-W4tcher/linux_tracing_ftrace
...
New Linux plugin: linux.tracing.ftrace
2025-02-05 21:49:15 +00:00
Abyss Watcher
f5e8ed2457
use a list comprehension for flags parsing
2025-02-05 21:42:13 +01:00
ikelos and GitHub
eadd6d229e
Merge pull request #1572 from hsarkey/hsarkey/wow64-dlllist
...
Windows: Allow windows.dlllist to report back DLLs from wow64 processes
2025-02-05 20:23:50 +00:00
hsarkey
29567a777b
Updates to address the dlllist wow64 upgrades
2025-02-05 15:10:36 -05:00
Abyss Watcher
637ff68035
make ftrace flags parsing more readable
2025-02-05 19:19:26 +01:00
Abyss Watcher
c01f3c5556
non inclusive upper bound address check
2025-02-05 19:17:25 +01:00
ikelos and GitHub
a4987b39d9
Merge pull request #1598 from volatilityfoundation/issue_1573_handle_iteration_traceback
...
Windows: Handles - catch exception in handle iteration
2025-02-03 22:42:27 +00:00
ikelos and GitHub
b3760ce7e5
Merge pull request #1599 from gcmoreira/linux_kallsyms
...
Linux - Introduce the Linux kallsyms API and related plugins
2025-02-02 23:32:01 +00:00
Gustavo Moreira
cef87e014c
linux: kernel_symbol object extension: move properties to getters
2025-02-03 07:59:57 +11:00
Gustavo Moreira
348720c89a
linux: module extension object: add docstring to get_symbol_type()
2025-02-03 07:55:11 +11:00
Gustavo Moreira
e222b069ef
linux: module extension object: add typing info to _get_sect_count()
2025-02-03 07:50:21 +11:00
Gustavo Moreira
13b8526206
linux: kallsyms API: reuse module_name variable
2025-02-03 07:40:17 +11:00
Gustavo Moreira
19fed19647
linux: kallsyms plugin: fix variable name typo
2025-02-03 07:38:43 +11:00
Gustavo Moreira
54ce358e8e
framework: minor version bump
2025-02-03 07:37:38 +11:00
Gustavo Moreira
bf0271cd57
linux: kallsyms plugin: simplify argument by removing the "only-" prefix, which was also causing confusion.
2025-02-02 12:29:01 +11:00
Gustavo Moreira
5347926ab6
linux: Add pscallstack plugin testcase
2025-02-02 11:34:31 +11:00
Gustavo Moreira
80f6d0dad6
linux: Add kallsyms plugin testcase
2025-02-02 11:33:34 +11:00
ikelos and GitHub
9a01f8307f
Merge pull request #1595 from volatilityfoundation/walk_internal_list_bug
...
Add smear checks and missing absolute flag to walk_internal_list
2025-02-01 12:31:48 +00:00
Mike Auty
df310c0d92
Manually revert 74a834b
...
This should resolve the issue experienced #1590 was trying to resolve.
2025-02-01 12:27:49 +00:00
Gustavo Moreira
1da15d1352
linux: pscallstack plugin: Fix canonical addresses
2025-02-01 20:55:54 +11:00
Gustavo Moreira
0ba331f34c
linux: kallsyms api: Added support for older kernels lacking mod_tree. Enhanced module address search performance by using the new module memory boundaries function
2025-02-01 20:55:40 +11:00
Gustavo Moreira
2af8b95ea4
linux: module object extension: add method to know the module memory boundaries based on its symbols addresses and sizes
2025-02-01 20:55:35 +11:00
Gustavo Moreira
9175c1b1e9
linux: kallsyms api: ensure all the addresses are in the same range
2025-02-01 20:55:29 +11:00
Gustavo Moreira
4469ab49c8
linux: kallsyms api: move the unsupport implementation message to the info log level
2025-02-01 18:12:51 +11:00
Gustavo Moreira
fbba4c7675
linux: new pscallstack plugin: add a poor man's process stack call enumeration plugin to showcase the power of the kallsyms API
2025-02-01 17:55:50 +11:00
Gustavo Moreira
d665fcc2b5
linux: kallsyms plugin: Enable filtering of symbols by subsystem
2025-02-01 17:55:42 +11:00
Gustavo Moreira
97135a992a
linux: add Kallsyms plugin
2025-02-01 17:55:33 +11:00
Gustavo Moreira
6174687204
linux: Introduce Kallsyms API
2025-02-01 17:55:21 +11:00
Gustavo Moreira
7e4b548e17
linux: task_struct object extension: Add method to get the task address space layer, even if its a kernel thread
2025-02-01 17:55:13 +11:00
Gustavo Moreira
e2431eebdf
linux: bpf_prog: Add methods to get the program address and its memory regions
2025-02-01 17:55:05 +11:00
Gustavo Moreira
0e0daffc45
linux: Add kernel_symbol object extension
2025-02-01 17:54:55 +11:00
Gustavo Moreira
88b32b0803
linux: task_struct object extension: Add helper to obtain the task state
2025-02-01 17:54:47 +11:00
Gustavo Moreira
dba90ac217
linux: Add support for module symbol types
2025-02-01 17:54:41 +11:00
Gustavo Moreira
18a69b9417
linux: add latched RB-trees implementation
2025-02-01 17:54:27 +11:00
Andrew Case
60dc0c04f4
Address feedback. Add doc strings
2025-01-31 22:37:21 -06:00
ikelos and GitHub
5a046ea0e4
Merge pull request #1590 from volatilityfoundation/mnt_parent_missing
...
Add mnt_parent check to kernel version validation
2025-02-01 01:46:46 +00:00
ikelos and GitHub
75b55c3b30
Merge pull request #1593 from volatilityfoundation/mountinfo_superblock_check
...
Add missing pointer validation check in mountinfo
2025-02-01 01:43:13 +00:00
ikelos and GitHub
346a5d98da
Merge pull request #1592 from volatilityfoundation/kthread_name_smear
...
Prevent backtraces when kthread full name is smeared
2025-02-01 00:56:10 +00:00
ikelos and GitHub
4df047beac
Merge pull request #1591 from volatilityfoundation/check_sock_access
...
Fix broken socket retrieval that causes backtrace
2025-02-01 00:55:08 +00:00
David McDonald
1d1af696ff
Windows: Handles - catch exception in handle iteration
...
An `InvalidAddressException` can occur inside of `__iter__` when
iterating over the handle table (the exact exception occurs when
creating the subtype in `objects.Array.__getitem__`. This changes the
handle code to do a manual iteration over the sequence using the array
length and indexes, catch the exception, log the index, and continue.
In the test sample that prompted this change, the exception occurred on
the access of the very last item in the array.
closes #1573
2025-01-31 17:35:08 -06:00
Andrew Case
3b3331a58d
Add smear checks and missing absolute flag to walk_internal_list
2025-01-31 22:32:35 +00:00
Andrew Case
efbc410c4d
Add missing pointer validation check in mountinfo
2025-01-31 21:43:32 +00:00
Andrew Case
644b967c62
Prevent backtraces when kthread full name is smeared
2025-01-31 21:31:07 +00:00
Andrew Case
4d43ac9a6d
Catch invalid address exception for invalid sock values
2025-01-31 20:46:16 +00:00
Andrew Case
cb3542f76a
Catch invalid address exception for invalid sock values
2025-01-31 20:40:51 +00:00
Andrew Case
1132bd9830
Add mnt_parent check to kernel version validation
2025-01-31 18:11:22 +00:00
Andrew Case
55b27a68d5
Add mnt_parent check to kernel version validation
2025-01-31 18:10:12 +00:00
ikelos and GitHub
1f983aca73
Merge pull request #1585 from volatilityfoundation/issues/issue1577
...
Expose and use `get_pefile_obj` rather than having local copies
2025-01-31 17:30:22 +00:00
ikelos and GitHub
b51acfd3fb
Merge pull request #1407 from eve-mem/WindowsCommitCharge_issue1400
...
Windows: Update get_commit_charge extension to handle Core.CommitCharge case
2025-01-31 16:44:24 +00:00
eve
e9d1831a7c
Windows: update get_commit_charge with CommitCharge fix by BeanBagKing
2025-01-31 14:45:28 +00:00
